2.6.32-stable review patch. If anyone has any objections, please let us know.

------------------From: Will Deacon <will.deacon@arm.com>

commit 1142b71d85894dcff1466dd6c871ea3c89e0352c upstream.

Commit 8b592783 added a Thumb-2 variant of usracc which, when it iscalled with \rept=2, calls usraccoff once with an offset of 0 andsecondly with a hard-coded offset of 4 in order to avoid incrementingthe pointer again. If \inc != 4 then we will store the data to the wrongoffset from \ptr. Luckily, the only caller that passes \rept=2 to thisfunction is __clear_user so we haven't been actively corrupting user data.

This patch fixes usracc to pass \inc instead of #4 to usraccoffwhen it is called a second time.